Pervasive devices (e.g., personal data assistants (PDAs), cellular smartphones, etc.) have become increasingly popular in today's mobile environment. In fact, these new, pocket-sized devices often encompass advanced functionality which rival capabilities of personal computers. Powerful pervasive devices small enough to fit in one's pocket, often complemented with wireless wide-area coverage, offer an appealing alternative to much bulkier and heavier laptop computers.
Mobile pervasive devices with and without wireless access are used for creating and storing confidential information every day. It is common for the pervasive device user to keep information such as passwords, credit card numbers, customer lists and client information on these devices. The very features that make pervasive devices so useful, such as extreme portability and ready access to critical data, also create a serious security risk. In most instances, the actual cost of hardware replacement is negligible compared to the potential liability for compromised sensitive data.
Several approaches have been developed to address the security concerns with the loss/theft of pervasive devices. A first major approach involves the use of a password to protect the pervasive device. Almost all pervasive devices offer some sort of built-in, power-on password to protect the device. However, a recent report from @stake, Inc. reveals that such password protection can be easily circumvented in a relatively easy, straightforward method (http://www.atstake.com/research/advisories/2001/a030101-1.txt).
Several “add-on” security products have been developed by third-party vendors for pervasive devices. A first example of such a product is TealLock™ from TealPoint Software. This product is configurable to lock down the device during certain hours rendering it useless during off-hours. Another product is PDASecure™ from Trust Digital, which allows a device user to set a password and lock access to certain applications. Yet another product, Sign-On™ from Communication Intelligence Corporation, utilizes biometric signature verification to keep the data on the pervasive device safe. In this product, a matching signature is entered onto the screen of the pervasive device, then the software compares this signature against a stored signature. The software senses not only the form of the signature, but also the speed and rhythm of the signing.
Another approach to safeguarding information within a pervasive device centers on the use of encryption/decryption techniques to protect the data. Encryption uses mathematics or specific algorithms to convert documents, e-mails, or other data files into scrambled data. Encryption ensures that private communications or files are not accessed by unauthorized persons. There are several programs currently on the market that offer this level of protection.
PDADefense™ from Asynchrony.com, is intended to provide PDA users with a high level of defense by “bombing” or deleting information on the PDS is there are any unauthorized attempts to access such information on the PDA device. FileCrypto™ from F-Secure is an automatic file encryption application for encrypting the data of all record-based applications when the device goes to sleep or is shut down.
The password/encryption approaches outlined above have some common disadvantages. Although technically sufficient, passwords and encryption can be difficult (i.e., due to the special handwriting recognition “grafitti” required, or a limited keyboard/keypad) or cumbersome (i.e., the device is often used for a very short period of time). This causes many pervasive device users to avoid passwords altogether, or to use trivial, easily defeatable passwords (e.g., a 4-character PIN, or a simple button combination).
Also, the approaches to security outlined above are “all-or-nothing” type of approaches. That is, the security feature is fully engaged or not engaged at all. There is no concept of risk-assessment based on the current status of the device, and coupling the risk assessment to an appropriate level of security protection for the device.
There is a need for a tiered, multi-stage intelligent detection and enforcement of security on pervasive devices. Such security measures should be minimally intrusive to the device operator, and cost-effective to implement.